2016-05-19

ICANN Data Breach, ICANN Refuses to Review New gTLD .HOTEL

ICANN has decided not to re-evaluate the decision to award new gTLD (new generic Top Level Domain), .HOTEL even though the winning applicant has been accused of using a security flaw in ICANN’s database to gain access to other applicants' confidential information (background note: the IRP declaration (pdf), the ICANN Board resolution).

In correspondence dated March 1 (pdf) and March 8 (pdf), 2016, Flip Petillion, an attorney representing other applicants for .HOTEL, told the ICANN Board of Directors and Akram Atallah, President of ICANN's "Global Domains Division," that they had been derelict in failing to properly investigate the data breach and that allowing the winning applicant to proceed would amount to:

"acquiescence in criminal acts that were committed with the obvious intent to obtain an unfair advantage over direct competitors. Such acquiescence would be contrary to ICANN's obligations under its Articles of Incorporation and Bylaws, and to ICANN's mandate to operate for the benefit of the internet community as a whole ..."

From evidence to date, it actually appears ICANN was at fault, in failing to properly secure its own website or 'portal' used by applicants, which may be the reason ICANN has dragged its feet --

In correspondence (embedded below), dated May 11, 2016, ICANN Vice President of gTLD Operations, Christine Willett, told Attorney Petillion that the ICANN Board of Directors would not further review the applications nor 're-evaluate' the winning application. Attorney Petillion had asked ICANN how it would proceed after the ICANN Board issued a resolution recommending ICANN staff investigate the data breach and whether ICANN would reevaluate the winner of .HOTEL, to which Willett responded:

“Your question conflates two aspects of the resolution ... nothing in the board’s resolution speaks to the re-evaluation of .hotel.”

Caveat Emptor: Never, ever, assume base-level competence on the part of ICANN.

See also Petillon's latest correspondence dated May 12, 2016, here (pdf), demanding ICANN cancel the winning application for .hotel. Stay tuned, we may have another case being filed in the U.S. District Court at Los Angeles.